> For the complete documentation index, see [llms.txt](https://docs.authgear.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.authgear.com/~/changes/anTCj6yoZ06s3pLJk5v8/get-started/authentication-approach.md).

# Choose your authentication approach

Decide how should the application requests be identified, either by access tokens or by cookies.

Authgear provides token-based or cookie-based authentication. You will need to decide which approach you are going to use before starting the setup.

|                      | **Token-based**                                     | Cookie-based                                                                  |
| -------------------- | --------------------------------------------------- | ----------------------------------------------------------------------------- |
| Suitable for         | **mobile apps** or **single-page web applications** | **Websites** in the same root domain (e.g. Server-side rendered applications) |
| Transport of session | **Access Token** in `Authorization` header          | **Session ID** in Cookies                                                     |

## Token-based authentication

This approach is suitable for **mobile apps** or **single-page web applications**.

In Token-based authentication, Authgear returns the `access token` and `refresh token` to the client app after authentication.

The client SDK will automatically renew the `access token` with the `refresh token` for you, so you don't have to worry about it.

Your client app should call your backend with the access token in the Authorization header, and you can verify the access token by integrating Authgear with your backend. The HTTP requests can be authenticated by [**Forwarding to Authgear Resolver Endpoint**](/~/changes/anTCj6yoZ06s3pLJk5v8/get-started/backend-api/nginx.md) or [**Validating JWT in your application server**](/~/changes/anTCj6yoZ06s3pLJk5v8/get-started/backend-api/jwt.md).

Request example:

```bash
> GET /api_path HTTP/1.1
> Host: yourdomain.com
> Authorization: Bearer <AUTHGEAR_ACCESS_TOKEN>
```

{% content-ref url="/pages/-MbFM4jLlPG\_W3D2lh3i" %}
[Token-based (Native mobile or Single-page app)](/~/changes/anTCj6yoZ06s3pLJk5v8/get-started/authentication-approach/token-based.md)
{% endcontent-ref %}

## Cookie-based authentication

This approach is suitable for **all types of websites**, including server-side rendered applications.

In Cookie-based authentication, Authgear returns `Set-Cookie` headers and sets cookies to the browser. The cookies are HTTP only and share under the same root domains. So you will need to setup the **custom domain** for Authgear, such as `identity.yourdomain.com`.

In this setting, if you have multiple applications under `yourdomain.com`, all applications would share the same session cookie automatically. After that, you can verify the cookies by integrating Authgear with your backend. The HTTP requests *must* be authenticated by [**Forwarding to Authgear Resolver Endpoint**](/~/changes/anTCj6yoZ06s3pLJk5v8/get-started/backend-api/nginx.md).

Request example:

```javascript
> GET /api_path HTTP/1.1
> Host: yourdomain.com
> cookie: session=<AUTHGEAR_SESSION_ID>
```

{% content-ref url="/pages/-MbFM4jMrcQjbyof5aMh" %}
[Cookie-based (Website or Single-page app)](/~/changes/anTCj6yoZ06s3pLJk5v8/get-started/authentication-approach/cookie-based.md)
{% endcontent-ref %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.authgear.com/~/changes/anTCj6yoZ06s3pLJk5v8/get-started/authentication-approach.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.